Read the docs
TI-2025-09723 Aliases CVE-2025-10622GHSA-f5h4-c4jw-c4gm

Foreman: os command injection via ct_location and fcct_location parameters

Priority LOW 38CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00728 54th percentileScored 2026-11-07
Fix Partial Foreman (The Foreman): 3.16.1Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Foreman ProjectForeman3.12.0 to before 3.16.13.16.1Patch availableCNA
Red HatRed Hat Satellite 6.15 for RHEL 8—3.9.1.13-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 8—3.12.0.11-1.el8satPatch availableCNA
Red HatRed Hat Satellite 6.16 for RHEL 9—3.12.0.11-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.17 for RHEL 9—3.14.0.10-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6.18 for RHEL 9—3.16.0.4-1.el9satPatch availableCNA
Red HatRed Hat Satellite 6——No fix listedCNA
  • Foreman VendorThe Foreman Project Affected 3.12.0 to before 3.16.1 Fixed in 3.16.1 Patch available CNA
  • Red Hat Satellite 6.15 for RHEL 8 VendorRed Hat Affected — Fixed in 3.9.1.13-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 8 VendorRed Hat Affected — Fixed in 3.12.0.11-1.el8sat Patch available CNA
  • Red Hat Satellite 6.16 for RHEL 9 VendorRed Hat Affected — Fixed in 3.12.0.11-1.el9sat Patch available CNA
  • Red Hat Satellite 6.17 for RHEL 9 VendorRed Hat Affected — Fixed in 3.14.0.10-1.el9sat Patch available CNA
  • Red Hat Satellite 6.18 for RHEL 9 VendorRed Hat Affected — Fixed in 3.16.0.4-1.el9sat Patch available CNA
  • Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 18

CPEVersionsRoleVendor
cpe:/a:redhat:satellite:6.15::el86.15—Red Hat
cpe:/a:redhat:satellite_capsule:6.15::el86.15—Red Hat
cpe:/a:redhat:satellite_utils:6.15::el86.15—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite:6.16::el86.16—Red Hat
cpe:/a:redhat:satellite_utils:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite:6.16::el96.16—Red Hat
cpe:/a:redhat:satellite_capsule:6.17::el96.17—Red Hat
  • cpe:/a:redhat:satellite:6.15::el8 Versions 6.15 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.15::el8 Versions 6.15 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.15::el8 Versions 6.15 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el8 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite:6.16::el9 Versions 6.16 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.17::el9 Versions 6.17 — ·Red Hat
Show 8 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:satellite:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_utils:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_maintenance:6.17::el96.17—Red Hat
cpe:/a:redhat:satellite_capsule:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_maintenance:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite_utils:6.18::el96.18—Red Hat
cpe:/a:redhat:satellite:66—Red Hat
  • cpe:/a:redhat:satellite:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_maintenance:6.17::el9 Versions 6.17 — ·Red Hat
  • cpe:/a:redhat:satellite_capsule:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_maintenance:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite_utils:6.18::el9 Versions 6.18 — ·Red Hat
  • cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat

Remediation

  • Fix · CNA Foreman (The Foreman) Fixed in 3.16.1

Red Hat 4 advisories

  • RHSA-2025:19856 Released 2025-11-06 · Red Hat rating Important
    Satellite 6.15.5.6 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 foreman-3.9.1.13-1.el8sat, foreman-cli-3.9.1.13-1.el8sat, foreman-debug-3.9.1.13-1.el8sat +13
  • RHSA-2025:19855 Released 2025-11-06 · Red Hat rating Important
    Satellite 6.16.5.5 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.11-1.el8sat, foreman-cli-3.12.0.11-1.el8sat, foreman-debug-3.12.0.11-1.el8sat +13
    • Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.11-1.el9sat, foreman-cli-3.12.0.11-1.el9sat, foreman-debug-3.12.0.11-1.el9sat +13
  • RHSA-2025:19832 Released 2025-11-05 · Red Hat rating Important
    Satellite 6.17.6 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.10-1.el9sat, foreman-cli-3.14.0.10-1.el9sat, foreman-debug-3.14.0.10-1.el9sat +13
Show 1 more Red Hat advisories
  • RHSA-2025:19721 Released 2025-11-04 · Red Hat rating Important
    Satellite 6.18.0 new version release
    • Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.4-1.el9sat, foreman-cli-3.16.0.4-1.el9sat, foreman-debug-3.16.0.4-1.el9sat +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2025:19856
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2025:19855
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2025:19855
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2025:19832
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2025:19721
Not affected: 5 products
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10622
  2. 2026-10-03 Alias added: GHSA-f5h4-c4jw-c4gm
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 4

Other 3

  • TI-2026-01620 Forman: foreman: remote code execution via command injection in websocket proxy CVSS 3.1HIGH 8.8
  • TI-2013-01912 The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not… CVSS 2.0MEDIUM 6.5
  • TI-2018-10506 Improper authentication in [UNKNOWN] smart_proxy_dynflow CVSS 3.0CRITICAL 9.8
  • TI-2013-01890 Eval injection vulnerability in the create method in the Bookmarks controller in Foreman… CVSS 2.0MEDIUM 6.0
  • TI-2012-03031 The installation script in Katello 1.0 and earlier does not properly generate the… CVSS 3.1CRITICAL 9.8
  • TI-2013-01882 The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2… CVSS 2.0MEDIUM 6.0
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences